Renew Let's encrypt certificate automatically without stopping nginx hosted on docker

One of the obvious answers is to not use certbot. There are many other ACME compatible clients, some that could use the DNS-01 challenge.

Or you could use a different proxy that has certificate renewal built in. One popular choice is Traefik, that works nicely as a proxy, and can automatically get certs using either HTTP or DNS challenges, depending on what you configure.

If you really want to stick with certbot, look at switching over to DNS validation if you can. Using DNS validation doesn't require opening any ports, it does require you be able to automatically publish a DNS record though.